The Gate Before Every Bash Call

The Gate Before Every Bash Call A workflow diagram generated by Archify. 01 / Every Bash Call git guard decision Bash command · any tool call · Every Bash Call Bash command any tool call PreToolUse · fires before the call · Every Bash Call PreToolUse fires before the call hook-git-guard.py · allow or block? · Every Bash Call › git guard decision hook-git-guard.py allow or block? Block · stderr + logged, no run · Every Bash Call › git guard decision Block stderr + logged, no run Command runs · unchanged · Every Bash Call › git guard decision Command runs unchanged runs the guard script dangerous pattern clean Legend User UI Agent logic Policy

The Guard Runs Before, Never After

  • • hook-git-guard.py decides allow or block before the command executes
  • • A block writes to stderr and appends a line — the command never runs
  • • There is no retry loop: a block ends the attempt, it does not queue a review